IDA Strings to Functions (ARM, Protected Functions)

Question

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference something like this:

 unk_134AB30     DCB 0xD0 ; -            ; DATA XREF: .data:0134AB58o
.data:0134AB31                 DCB    0
.data:0134AB32                 DCB    0
.data:0134AB33                 DCB    0
.data:0134AB34                 DCD aMlinewidth         ; "mLineWidth"
.data:0134AB38                 DCD aF_0                ; "f"

Are these structures? If so, how do I get the actual value or function of "mLineWidth"?

To get to here, I looked at the cross-references to the string, and aMlinewidth references it as so:

 aLinewidth      DCB "lineWidth",0

I then looked at the cross-references to, "aLinewidth" and got where I am now. Another example would be going from: "mCueBallRenderLine" string:

aMcueballrender DCB "mCueBallRenderLine",0

And then the cross-references of aMcueballrender lead to here:

                 DCD aC_0                ; "c"
.data:01625F88 unk_1625F88     DCB 0x32 ; 2            ; DATA XREF: .data:01626004o
.data:01625F89                 DCB    1
.data:01625F8A                 DCB    0
.data:01625F8B                 DCB    0
.data:01625F8C   

DCD aMcueballrender     ; "mCueBallRenderLine"

, Which is similar to the other example in terms of it's structure. All of the unknown references (unk_xxxx) seen above all lead to something like this:

DCD unk_151AB20
.data:0151C2DC                 DCD unk_151B7C0
.data:0151C2E0                 DCD unk_151BED0
.data:0151C2E4                 DCD unk_151A5A0
.data:0151C2E8                 DCD unk_151BDE0
.data:0151C2EC                 DCD unk_151B6C0
.data:0151C2F0                 DCD unk_151AAF0
.data:0151C2F4                 DCD unk_151BE80
.data:0151C2F8                 DCD unk_151BF70
.data:0151C2FC                 DCD unk_151B180
.data:0151C300                 DCD unk_151BF20
.data:0151C304                 DCD unk_151ABA0
.data:0151C308                 DCD unk_151B2E0
.data:0151C30C                 DCD unk_151B270

I am trying to find the actual function/value of the string, but I can't get to anywhere where it lists sub_xxxxx.

Answer 1

• These sub_xxx functions are not protected, just stripped, which means that your executable is compiled without debug information.
• It looks like that access to these strings is centralized and done with some of the functions you did not find yet.
• Yes, you can represent these similarly organized definitions as structures or array of structures. This will probably make your RE work easier.
• The last array you referencing should be referenced from somewhere too. Try to find where it is referenced from, and may be this will give you some information about structure of the data. I suggest that there is a function, which returns address of one of these structures or its parts by id and this function references the last array you mentioned or its parts.

Good luck.